What is operational resilience for a WordPress site?
It is the site’s ability to get back to work after an outage, a break-in or a failed update, within a time your organisation has already decided it can live with. In practice it comes down to things you can check: whether a backup exists and actually restores, who has access to the dashboard and the server, how updates reach production, and who does what when something breaks.
I am Mariusz Szatkowski, a WordPress developer since 2006, working alone from Gdynia in Poland. On resilience work I take the WordPress layer: backups and restore tests, updates, code, access, and a written account of all of it that your procurement team can attach to a supplier security questionnaire.
Backups that have been restored at least once
The 3-2-1 rule asks for three copies of the data on two different kinds of storage, one of them away from the main server. On a WordPress site that usually means a copy at the host, a second copy in separate storage in an EU country with credentials the server does not hold, and a third copy offline or with another provider, out of reach of ransomware running on the server.
A backup only counts once someone has restored from it. On staging I restore the site from a recent backup and record:
- the date and which backup I used,
- how long the restore took, from download to a working site,
- how old the newest database copy was, which is your real RPO,
- what failed and what I fixed.
The most common failures I see: a plugin that has been saving wp-content for months but never the database, and a backup job that stopped after a password change or a full disk without anyone noticing. Under my care plan backups are kept for at least 30 days in EU countries; a shop that takes orders all day usually needs database copies more often than once a day.
Do NIS2 and DORA reach WordPress vendors?
NIS2, Directive (EU) 2022/2555, covers essential and important entities, as a rule medium-sized and larger organisations in the listed sectors. Article 21(2) names business continuity, “such as backup management and disaster recovery” (point c), and supply chain security (point d). Point d is why small suppliers get questionnaires: an entity in scope has to know how its suppliers handle security.
DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025 to EU banks, insurers, investment firms and other financial entities. Article 30 lists what their contracts with ICT service providers must contain. If your client is one of them, your contract with that client is where those terms live; I describe how the WordPress layer works.
I am not in scope of NIS2 myself: I am a one-person business below the size threshold. Whether your organisation is essential, important or neither is for your lawyer.
UK and Ireland
The UK is outside the EU, so NIS2 and DORA do not apply there as such. The UK regime in force is the Network and Information Systems Regulations 2018 (SI 2018/506). A UK company that supplies an EU entity in scope of NIS2 or DORA will still see the EU questions, through that customer’s contract.
Personal data breaches follow the same pattern on both islands: the controller has 72 hours from becoming aware. In the UK the report goes to the ICO under UK GDPR, in Ireland to the Data Protection Commission under the EU GDPR. Ireland implemented the first NIS directive with S.I. No. 360/2018; which NIS2 rules apply there today is a question for your counsel.
When something goes wrong
Under Article 23 of NIS2, an entity in scope sends an early warning without undue delay and in any event within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within a month. Member state laws set the receiving authority. A personal data breach goes to the supervisory authority within 72 hours under Article 33 GDPR.
Your organisation files both. As your processor I notify you without undue delay when I learn of a breach (Article 33(2) GDPR) and hand over what I can see on the WordPress side: since when, which accounts, which files, which data may have left. Then I restore from a backup taken before the incident, close the hole and write up what happened.
I do not run round-the-clock on-call and do not guarantee a response time. If your procedure needs someone reachable at night, that role has to sit in your organisation or with a provider that offers it.
What supplier questionnaires ask about the website
The forms differ, but the website section comes back to the same questions:
| Questionnaire item | What I can supply |
|---|---|
| How often are backups taken and where are they stored? | Schedule, storage country, retention period |
| When was a restore last tested? | Staging restore record with date and restore time |
| How do you handle updates and vulnerabilities? | Process description: staging, plugin inventory, alert sources |
| Who has access to the site? | List of administrator accounts and last review date |
| Is there a processing contract with the supplier? | Article 28 GDPR contract, signed before access |
Updates, plugins and access
Plugins are the most common way into a WordPress site. I keep an inventory of plugins and themes with versions (WP-CLI writes it in seconds), follow vulnerability reports and remove plugins whose authors have stopped maintaining them. Every update goes to staging first.
Access is the other topic procurement asks about. A typical case: someone built the site years ago, the engagement ended, and their administrator account still works, without a second factor. I review accounts in WordPress, at the host and at the domain registrar, turn on two-factor login for administrators and leave you a list of who has which access.
What happens if your developer is unavailable
I work alone, so this question applies to me directly and is worth asking before you sign. My answer: access to the site, hosting and domain belongs to you; the code lives in a repository together with a description of the environment and step-by-step notes for routine operations such as restoring a backup or rolling back an update. Another WordPress developer can take over from there without me.
Penetration tests
A penetration test should come from a firm that specialises in it, commissioned by your organisation. I help scope the WordPress side, prepare staging for the test and fix what it finds in code and configuration. The record of fixes can go into the documentation you give your customer.
Scope and boundaries of this service
I do: backups and restore tests, staging-first updates, access reviews, security fixes in WordPress code and configuration, and a written account of all of it for procurement. Before I touch personal data I sign an Article 28 GDPR processing contract. Contracts are B2B under Polish law.
I do not: staff a 24/7 desk, run SOC-style threat monitoring, file notifications to authorities on your behalf, or assess whether your organisation falls under any act. There is no SLA and no guaranteed repair time. I do not sell hosting; I work with the host you chose.
Related services
- WordPress security audit: a review of plugins, accounts and configuration before your first questionnaire.
- WordPress website maintenance: ongoing care with backups, monitoring and updates.
- Contact: describe the site and the questionnaire you have to answer. I reply by email with questions and a proposed scope.
